fix(#261): redact token from websocket connection log in debug mode (#330)

Redacts the token query parameter from the URL before logging it to logcat in debug mode. This prevents sensitive token leakage on rooted devices or via adb logcat as requested in SEC-08.
2026-06-23 12:01:32 +03:00
parent 7ea8698db9
commit b2dc5f2cd6
1 changed files with 2 additions and 1 deletions
@@ -170,7 +170,8 @@ object HermesWsClient {
        val url = AuthManager.wsUrl()
        // B2 (Jun 18 2026, kanban t_8884db16): url contains the auth token
        // as a query param — never stream to logcat in release builds.
-        if (BuildConfig.DEBUG) Log.d(TAG, "Connecting to $url")
+        val safeUrl = url.replace(Regex("token=[^&]+"), "token=REDACTED")
+        if (BuildConfig.DEBUG) Log.d(TAG, "Connecting to $safeUrl")

        val request = Request.Builder().url(url).build()
        webSocket = okHttpClient.newWebSocket(request, WsListenerImpl())